CVE-2023-38037 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator...

CVE-2023-38037 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator...

GHSA-Q2X7-8RV6-6Q7H vulnerabilities

Vulnerabilities for packages: emissary, checkov, mlflow, superset, kubeflow-jupyter-web-app, airflow, kubeflow-volumes-web-app, py3-jinja2, localstack, reflex, kubeflow-pipelines-visualization-server, apache-beam-python-3.11-sdk, ansible-operator, kserve, dask-gateway, nemo...

GHSA-GMJ6-6F8F-6699 vulnerabilities

Vulnerabilities for packages: emissary, checkov, mlflow, superset, kubeflow-jupyter-web-app, airflow, kubeflow-volumes-web-app, py3-jinja2, localstack, reflex, apache-beam-python-3.11-sdk, ansible-operator, kserve, dask-gateway, nemo...

CVE-2024-56201 vulnerabilities

Vulnerabilities for packages: emissary, checkov, mlflow, superset, kubeflow-jupyter-web-app, airflow, kubeflow-volumes-web-app, py3-jinja2, localstack, reflex, apache-beam-python-3.11-sdk, ansible-operator, kserve, dask-gateway, nemo...

SUSE CVE-2024-43803

The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost BMH CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the Name and Namespace of th...

OPENSUSE-SU-2024:0413-1 Security update for python-python-sql

This update for python-python-sql fixes the following issues: - CVE-2024-9774: Fixed that unary operators does not escape non-Expression boo1234653...

GO-2024-3349 OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather

OpenShift Must Gather Operator Improper Input Validation vulnerability in github.com/openshift/must-gather. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2024-3109 The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator

The Bare Metal Operator BMO can expose particularly named secrets from other namespaces via BMH CRD in github.com/metal3-io/baremetal-operator...

CVE-2024-25131 Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalation

A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource CRD of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard...

CVE-2024-25131 Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalation

A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource CRD of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard...

GHSA-W32M-9786-JP63 vulnerabilities

Vulnerabilities for packages: glab, thanos-operator, cass-operator, promxy, opentelemetry-operator, k9s, fulcio, crossplane-provider-aws-lambda, cloudnative-pg, cni-plugins, flux-helm-controller, flux-kustomize-controller, velero-plugin-for-microsoft-azure, pulumi, terraform-provider-tls,...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v5.0.3 is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v5.0.3 is vulnerable to multiple Operator package issues.. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for...

CVE-2024-42407

Insertion of Sensitive Information into Log File CWE-532 in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to...

CVE-2024-42407

Insertion of Sensitive Information into Log File CWE-532 in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affects: Command Centre Server 9.10 prior to...

GHSA-V778-237X-GJRC vulnerabilities

Vulnerabilities for packages: glab, certificate-transparency, kserve-modelmesh-serving, kaniko, minio, step-issuer, crossplane-provider-sql, trivy, aactl, gh, jitsucom-bulker, mongo-tools, promxy, vcluster, falcoctl, crossplane-provider-family-azure, amass, grafana-alloy, helm-operator,...

Moderate: Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 3.3.2 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...

NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host.

...

CVE-2024-42457

A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading ...

CVE-2024-42457

A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading ...